VDB
CVE-2017-1000376
CVE-2017-1000376
PUBLISHED
CVSS 7 HIGH
libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1.
EPSS 0.50% · 41.1th percentile
Risk Scores
CVSS 3.0
7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.50%
41.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:14.04:LTS | libffi | 3.0.13-4, 3.0.13-5, 3.0.13-6 |
Timeline
- Jun 19, 2017 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Dec 30, 2021 EPSS Score
- Mar 3, 2022 EPSS Score
- May 5, 2022 EPSS Score
- Jul 7, 2022 EPSS Score
- Sep 10, 2022 EPSS Score
- Jan 14, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 18, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2017-1000376 third-party-advisory
- https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt third-party-advisory
- https://access.redhat.com/security/cve/CVE-2017-1000376 third-party-advisory
- https://ubuntu.com/security/notices/USN-3454-1 vendor-advisory
- https://ubuntu.com/security/notices/USN-3454-2 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2017-1000376 third-party-advisory